SCC Statement on SELinux Patent Issues 65
Hawke writes "Secure Computing has
announced a
Statement of Assurance that they will not use the patents in question to limit the availability of SELinux. They continue to say: 'However, Secure Computing does not extend the Assurance to software that merely interoperates with SELinux, or is merely included with a distribution of SELinux.'" The original story was here.
Nor.... (Score:3, Insightful)
Software Patents: Don't do them kids.
Re:Nor.... (Score:4, Interesting)
Basically this means that the parts of SELinux that they have a patent on, are free of licensing restrictions, so long as the distribution continues to be SELinux (you are free to modify it and re-distribute under the same name) and so long as they have not reassigned those rights on the patent to a third party.
Forgive me if I seem a bit less than touched by the assurance, but this assurance seems to me to be exceedingly self serving, and no assurance of anything.
-Rusty
Bound? (Score:1)
People are typically ok dudes when all is well, but when times get hard they even break the real laws, so this assurance is meaningless to me.
Its like buying a gun and assuring everyone you will never use it.
Re:Nor.... (Score:4, Interesting)
Last year in a show of how easy it was to disrupt and abuse the patent process by registering a common, every-day idea a Melbourne lawyer patented a "circular transportation facilitation device" [bbc.co.uk] with more info on the story here, [theage.com.au] here [ipmenu.com](pdf file), and here [harvard-magazine.com]
Obviously it's too easy to get things patented these days, especially in areas of high technology as few if any patent officer workers are well versed in the areas of technology. Most of the patent office stampers would have little inclination as to how an intigrated circuit works or if an item of software recently designed is any different or unique from any other piece of similar software.
Sure, it's nice to be able to patent and protect your inventions and innovations, but when most of today's patent holders are larger corporations, it's hardly meant to protect the garage inventor anymore.
Re:Nor.... (Score:5, Interesting)
Utterly cynical. However it demonstrates how bad the US patent problem is. Even the NSA, the US ultimate investigative and spook agency can't get patent stuff sane. So now the US government has written a security system that only foreign governments can profit from due to bad USSA law and poor planning.
Its a pity Americans don't understand irony...
patents (Score:1)
Re:patents (Score:1)
So they've effectively nullified the GPL? (Score:3, Informative)
Patents directly nullify this - with SELinux I can't modify it and make my own distro, or take the good bits of the code and use it in my own GPL project... making SELinux essentially proprietary.
Re:Nooo.. (Score:3, Interesting)
This patent has directly overriden this. If I took the patented code and created a GPL app based on it I would be sued for patent infringement.
They have only dropped royalties for SELinux, not apps derived from it.
Re:Nooo.. (Score:2)
If that were true then any contributor to Linux could sue the NSA for Copyright Infringement.
You cannot take GPL software, write patent encumbered code into it, and distribute it with additional restrictions.
Re:So they've effectively nullified the GPL? (Score:3, Interesting)
Not entirely true. As long as SELinux refrains from enforcing the patent or collecting royalities you can make your own distro. The problem is you can do it today but there is nothing in the bogus statement that would prevent them from changing their minds tomorrow.
The only way you and any people who use your distro or SELinux's distro would be safe is if they included a non exclusive license that insured royality free use and redistrubition rights. The statement clearly states they aren't licensing the Patents, so any redistrubition could be hazzardous to your finical health in the future.
It dosen't seem to violate the letter of the GPL, but it makes a mockary of the spirit of the License, and I hope The FSF closes this loophole ASAP
Re:So they've effectively nullified the GPL? (Score:2)
Then one day the company changes hands, and the new owners want to enforce the patent.
They would have just negated theri ability to distribute the code in the first place, as, under the GPL, tehy have no right to do this if it's encumbered.
This raises the important question: (Score:1, Flamebait)
Competitors aren't an argument because the publishing of the sources of SELinux according to the GPL would count as prior art.
Did they want to troll RMS and Anal Cox or what else ?
Or is this statement just a scam ?
Re:This raises the important question: (Score:2, Interesting)
"why do they release this statement?"
If they dont ppl avoid SElinux,
but now people wont really avoid it.. and once it becomes common they can actually hold ppl to ransom.
This is called corporate skills. This is what is taught in a B'School. I have friends from B'school and they tell me ethics are passe do anything to get marketshare!
So its pretty simple here, and i wont be using it unless those patens vanish *sigh*
The MS'ian Loophole (Score:3, Interesting)
===
No Third Party Restrictions.
This Statement of Assurance is made by Secure
Computing alone, and does not bind or obligate any other person or party. Secure
Computing may license or otherwise transfer any or all of its rights in the Subject Patents,
including the Subject Patent Rights, without any restriction or condition. The recipients
of such rights are not bound by this Statement of Assurance, and may assert any rights
acquired from Secure Computing without any limitation or restriction.
===
If the patents are transfered, they can then be enforced. Any existing distributions and installations of SELinux will become subject to unilateraly imposed lisence and royalty fees imposed by a new owner.
No way is this:
"Our assurance is subject to certain limitations that we believe are consistent with the spirit of open source. "
No License (Score:5, Insightful)
It's just a PR move. There is nothing that would prevent SELinux from modifying or abbandoning this statement at any time. It provides no protections to users if SELinux is sold, or the Patent sold. They can even grant a third party a license that would enable the third party to collect the license fees that SELinux is pretending to abbandon.
The level of dishonesty shown by this statement has lowerd my leval of trust in SELinux, and made me more unlikely to use the software on a personal basis and reinforced my view that it would be a mistake to use SELinux in a commerical setting.
Re:No License (Score:3, Insightful)
+lots, insightful, and the exact same situation applies to the Red Hat patents, or any patents owned by "friendly" companies who's friendship stops just short of giving explicit licenses.
Just because Secure Computing and Red Hat have agreed not to press their patents under certain circumstances doesn't mean that the patent isn't still a sword of Damocles. Indeed, this "Assurance" isn't very assuring at all, as it makes it very clear that the patent can be sold at any time, with no restrictions on the purchaser.
Companies change. Their directors change. They find a sudden need for money. They go bust, and when they do, their patents are sold to the highest bidder by the liquidators, and their good intentions are ignored.
Consider what would happen if Secure Computing and/or Red Hat went bankrupt? Could the FSF outbid Microsoft for the patents? I very much doubt it.
Re:No License (Score:5, Insightful)
from the GPL Preamble
The FSF has failed to take the chilling effect of an unlicensed unenforced patent into consideration. As long as Red Hat and SELinux don't enforce patents on GPLed software they are in compliance with the GPL, but the danger that the patent could be enforced at some future date makes it risky to make a derritive work based on patented GPL software, or even to redistrubite it. The practice clearly goes against the spirit of the GPL.
The GPL needs to be modified so that there is a ban on including any patented code unless it also includes a royality free license with redistrubition rights. Simply refraining from enforcing patent rights (for now) does nothing to insure that users will retain the right to redistrubite and modify in the future.
type enforcement (Score:4, Informative)
http://www.securecomputing.com/index.cfm?sKey=738 [securecomputing.com]
As it turns out, this is the problem child. SCC has a patent on this technology, and seems to have used it in SE Linux
hrmm their statement has a typo in the patent (Score:3, Informative)
It doesn't exist in any of the searches I made
Re:hrmm their statement has a typo in the patent (Score:2, Interesting)
Someone made a mistake, but it wasn't you. The right number is 4621321. I wonder if the mistake was intentional, so they could later enforce that patent and claim they're still in compliance with their statement. That doesn't make much sense, but I guess it isn't impossible.
To sum up (Score:4, Funny)
Where do I sign up?
Re:To sum up (Score:4, Interesting)
Please don't start this again. Paranoia over the nation's most powerful spy agency aside, Security Enhanced Linux has introduced a myriad of useful security ideas into the Linux world. SELinux uses type enforcement and role-based access control to secure the operating system from the ground up; instead of relying on applications to perform their own security, SELinux ensures that programs only have access to the system resources that they SHOULD have, and nothing more.
Furthermore, a presentation of SELinux by NSA officials at the 2.5 Linux Kernel Summit in March 2001 spurred Linus to propose an idea that has come to be the Linux Security Module, which will hopefully make it's way into the 2.5 kernel eventually. Under this system, and security module, not just SELinux, can be quickly loaded into the Linux kernel to provide whatever kind of security the user desires.
The fact that SCC has issued this statement, however cryptic, is a huge step in the right direction for the Linux world, and perhaps the entire UNIX world. It ensures the current development of SELinux by the NSA and its contributers, and allows Linux users to employ one of the more secure operating system implementations out there.
The National Security Agency has been making good strides towards making better public relations, and SELinux would appear to be a good weapon in giving them a better public image. If still paranoid, just download the source and view it yourself; it's not huge, and it's very clean-cut and understandable.
Limiting the Availability of SELinux... (Score:3, Interesting)
Seems to me they are confused. FreeSoftware supporters will limit their
use of SELinux and that inturn will Limit
can expect limited use of it, regardless of what dillusions they speak.
Pantents (Score:2, Interesting)
They licensed it to us to use as we see fit, just as long as we release the source, right?
Mike
Let's tear this thing apart... (Score:5, Insightful)
2. Non-Assertion section. "Subject to the limitations described in this Statement of Assurance, Secure Computing will not assert the Subject Patent Rights with respect to any use, modification or distribution of SELinux software that is permitted by, and is in compliance with, the terms and conditions of Version 2 of the GNU Public License (the "GPL")."
This is a catch-22. If they're already not in compliance with the GPL due to patent restrictions simply existing on their code, then according to this statement, they may very WELL assert the Subject Patent Rights. This whole clause is a sneakily worded contradiction of realities.
3. SELinux Limitation section.
"... However, Secure Computing does not extend the Assurance to software that merely interoperates with SELinux, or is merely included with a distribution of SELinux."
Translation: Unless they specifically _say_ your code may use their patented methods, forget it. The very nature of distributions is that the kernel is married with a distro's specific patches, custom scripts, custom installer, and a whole bunch of applications are "merely included".
4. Subject Patent Rights Limitation section.
"... Secure Computing does not waive, modify or release any of the Subject Patent Rights, or any other right in the Subject Patents, except as expressly provided in this statement of Assurance.
(Which we're already seeing is "effectively nothing") This section goes on to say that Secure Computing reserves the right to assert their Subject Patent Rights with respect to anything remotely useful regarding security applications that you might want to use their patented software for!
5. No Third Party Restrictions section.
Just go read it. If we sell it, you're screwed.
6. Other Patents section. Again, go read it. We may have other Patent landmines related to SELinux. Here's your blindfold, now go play hopscotch in that legal minefield over there.
7. No Licence section.
"No license is granted in this Statement of Assurance with respect to the Subject Patents, or any other patent or intellectual property right, or software or other product."
Then what exactly am I assured of, other than "We have Patents, we have rights, and they remain ours" ?
8. Limited Assurance section.
More legal handwaving and Covering of asses.
This whole document ranks right up there with "The check is in the mail", "I'm here from the government to help you", and other infamous promises made just before you get screwed over.
Re:Let's tear this thing apart... (Score:1)
Are you sure? The respective paragraph of the GPL reads:
7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program.
So, if you are explicitly told that this patent will not be enforced with respect to GPL software, there should not be any problems...
Of course, the question remains whether the assertion might be revoked some time.
GPL and patents don't mix (Score:2, Insightful)
If a GPLed project includes any patented code, then, under the GPL, I can take just the code from the project pertaining to the patent, create a derived work, sell it, and become rich. It is inconceivable that the company owning the patent would not sue me. Therefore, if they release patented code in a GPL project, they better give a royalty-free license to everyone.
Any Linux copyright holder can stop this (Score:3, Informative)
Re:Any Linux copyright holder can stop this (Score:4, Informative)
Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all.
Now you think that would be pretty clearcut, wouldn't you? Nonetheless, in the case of RTLinux, RMS did publicly state the patent holder could enforce his patent against users of non-GPL applications running under a modified Linux system containing code subject to the patent, without violating the GPL. Go figure. That doesn't sound like 'everyone's free use'.
In the case of the RTLinux patent, luckily a workaround was found, which is even superior to the patented method, so the question of whether the patent holder really was violating the GPL became moot. But, not too surprisingly, here is almost the same thing come up again. RMS needs to take a position.
That is why you have to read contracts (Score:1, Interesting)
RMS wrote the license. Having written it, he is free to state how he interprets what he wrote. Barring courts ruling on it, his interpretations have considerable weight. But only if they are reasonable as interpretations of what he wrote. For him to say that his license says what it does not (that a patent licensed for GPLed use has to be licensed for anyone's use) would be a lie and useless.
That said, the question becomes whether he disagrees with his license, and whether either of them disagree with your understanding of what he meant. I submit that he agrees with his license. The freedom to write GPLed versions of software - which can then become available for anyone's free use - is exactly what he wants to encourage. Your inability to write software that denies others their freedom to use it doesn't matter to him.
Remember. The GPL is designed to encourage widespread use of the GPL, which in turn is meant to push RMS' social philosophy. It is coincidentally useful for a lot of people who disagree with RMS' beliefs. But the fact that it does not satisfy those people in all the ways that they would like to be satisfied is not a failing of the GPL, and is not a problem for RMS.
Re:That is why you have to read contracts (Score:2)
Hi Victor,
What he would like to encourage and what the license says are different things. The GPL states quite plainly: "we have made it clear that any patent must be licensed for everyone's free use or not licensed at all." No qualifications. In particular, nothing remotely like "for everybody's free use so long as all the software they use is GPL".
Patents arent valid in all countries. (Score:2, Interesting)
Re:Patents arent valid in all countries. (Score:4, Interesting)
The USA is the only country with such ill educated government officials
Re:Patents arent valid in all countries. (Score:3, Informative)
How is this legal? (Score:2)
If not, then aren't they distributing GPL code written by others as a part of an assemblage that does not grant to others the right to freely modify and redistribute it?
Are they claiming that none of the patented code is linked?
Or is this just total FUD?
Whatever the answer to any of these, this is one company that deserves to die a quick death.
Re:How is this legal? (Score:2)
If not, then aren't they distributing GPL code written by others as a part of an assemblage that does not grant to others the right to freely modify and redistribute it?
Perhaps they think that they can freely give the right to modify and redistribute the software, while imposing restrictions on the right to use it. Come to think of it, there's very little said in the GPL about the use of a program, versus distribution of it. Perhaps distribution means 'distribution for use', but I don't see that clearly stated.
Re:How is this legal? (Score:3, Interesting)
Re:How is this legal? (Score:1)
I think so. I'm not a lawyer, but the patents appear to discuss hardware, not software. Would they apply to SELinux in that case?
Of course, whether a patent is ultimately enforcable has little to do with anything--if you can cost someone millions of bucks in litigation, that has to be taken as a pretty realistic threat.
Can they revoke this statement at any time? (Score:1)
So, could anyone with a legal background please comment - is this letter in any way binding to Secure Computing?
Re:Can they revoke this statement at any time? (Score:1)
This is not binding on them at all.
Other Divisions of the NSA made this possible (Score:2)
See also:
Some guys from the mafia visited with me today. On a completely unrelated note, I've decided to switch ro another trucking firm that charges 3 times as much.
Comment from Alan Cox (Score:3, Informative)
The assurance simply says you cannot use it. Using it for authorization
for applications, or services is excluded. That makes it useless
He seems to like it less than I do.
Oh well, it'll be good if this goes to court, having
the NSA (represented by the Justice Department)
defending the GPL would set a good precedent.
Statement of We Love Uncle Sam's money. (Score:1)
We promise will not attempt to sue to world's largest black budget organization, and is the government agency with the fewest publicly available details (part of mandate in E.O. 12333 [cia.gov] is classified).
We fear their black helicopters.
NSA needs to buy the patents. (Score:1)
Something obvious (Score:1)
I'm not an attorney but when someone attempts to enforce a patent they must show contribution to the work. In the case of this patent the NSA did all the genuine work and further released the details of this work publicly which means that SELinux would lose any lawsuit. The patent is entirely worthless and doesn't change anything. I can threaten to sue somebody just as easily with a valid or an invalid patent but if I can't win the case the threat is nothing but hot air.
Re:Something obvious (Score:1)
Pity (Score:1)